Claude review: fbdev: omap2: fix use-after-free in omapfb_mmap

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: fbdev: omap2: fix use-after-free in omapfb_mmap
Author: Hongling Zeng <zenghongling@kylinos.cn>
Patches: 1
Reviewed: 2026-06-04T13:05:53.596691

---

This is a single patch fixing a real use-after-free race condition in the omapfb driver's `mmap` path. The analysis in the commit message is accurate and well-explained: `omapfb_mmap()` takes a reference to `rg` via `omapfb_get_mem_region(ofbi->region)`, but then calls `omapfb_get_region_paddr(ofbi)` which re-dereferences `ofbi->region` — a pointer that can be changed concurrently by `OMAPFB_SETUP_PLANE`. This means `start` and `len` can come from a different region than the one whose `map_count` gets incremented, allowing the actual mapped region to be freed.

The fix is correct in principle: it reads `start` and `len` directly from `rg` (the locked region) rather than going through helpers that re-read `ofbi->region`. This ensures all values are consistent with the region being reference-counted.

**Verdict: The patch is correct and should be accepted**, with one minor observation below.

---
Generated by Claude Code Patch Reviewer